LayoutTests/imported/blink/editing/apply-inline-style-to-element-with-no-renderer-crash.html

<script>
if (window.testRunner)
    testRunner.dumpAsText();

// If we create an anchor element using execCommand('CreateLink') in an SVG namespace it won't get a renderer because the command will create
// an HTML rather than an SVG anchor. Our subsequent attempt to apply an inline style on the should fail rather than result in a crash.
onload = function() {
    tspan = document.getElementById("tspan");
    tspan2 = document.getElementById("tspan2");
    textPath = document.getElementById("textPath");

    colorprofile = document.createElementNS('http://www.w3.org/2000/svg', 'color_profile');
    li = document.createElement('li');
    colorprofile.appendChild(li);
    document.implementation.createDocument('' ,'' ,null).adoptNode(colorprofile)

    input=document.createElement('input');
    textPath.parentNode.insertBefore(input, textPath);
    window.getSelection().setBaseAndExtent(input, 4, input, 4);

    document.designMode='on';
    document.execCommand('Transpose');
    document.execCommand('selectall');
    document.execCommand('CreateLink', 0, '#');
    document.execCommand('CreateLink', 0, '#');
    document.execCommand('Undo');
    document.designMode='off'
    document.execCommand('Undo');
    document.execCommand('Undo');
    document.designMode='on';
    document.execCommand('italic');

    document.write("PASS. WebKit didn't crash.");
}
</script>
<svg>
    <text>
        <tspan id="tspan">
            <tspan id="tspan2">%uef5f%u9776%u638a</tspan>
            <textPath id="textPath"></textPath>
        </tspan>
    </text>
</svg>